Advice Request Can Antiviruses Access the Places I Specify?

[ciao]

Hello, there is a lot of disagreement about this. That's why I wanted to ask someone who knows about it. My question is:

ADVANCED THREAT PROTECTION of antiviruses (can be any) Can "MBR/GPT, boot sector/VBR, BIOS/UEFI firmware, EFI system partition" access and detect threats there?


Some say if it's UEFI it can access and detect, some say it can't reach it at all, some say it can access and detect all of them. What is the truth, can an expert or someone who knows tell me?

 

[Shadowra]

Hello

It is mainly to detect Rootkit and MBR modifications made by MBRLocker Ransomware.
On the other hand, all the systems are in UEFI, so the antiviruses integrate defenses to counter them

 

[ciao]

Hello

It is mainly to detect Rootkit and MBR modifications made by MBRLocker Ransomware.
On the other hand, all the systems are in UEFI, so the antiviruses integrate defenses to counter them

So it doesn't actually scan for viruses out there?

 

[Shadowra]

So it doesn't actually scan for viruses out there?

In the MBR if.
Kaspersky, Eset and Bitdefender do it

 

[ciao]

In the MBR if.
Kaspersky, Eset and Bitdefender do it

In other words, in systems with MBR (I guess when MBR the system is LEGACY, so I get both the same) only changes are checked and a scan is not performed. So what happens on UEFI systems?

 

[Shadowra]

In other words, in systems with MBR (I guess when MBR the system is LEGACY, so I get both the same) only changes are checked and a scan is not performed. So what happens on UEFI systems?

There is an .EFI file that is checked in analysis

 

[ciao]

There is an .EFI file that is checked in analysis

In other words, legacy systems cannot be scanned, but changes are checked. New systems with UEFI are also scanned and access advanced threat protection right?

 

[Shadowra]

In other words, legacy systems cannot be scanned, but changes are checked. New systems with UEFI are also scanned and access advanced threat protection right?

Yes

 

[ciao]

Yes

So what I'm saying is not accurate? So is it certain that ESET will notice changes in LEGACY, or is it also certain that ESET's ADVANCED THREAT PROTECTION will access UEFI and detect viruses there?

 

[Shadowra]

So what I'm saying is not accurate? So is it certain that ESET will notice changes in LEGACY, or is it also certain that ESET's ADVANCED THREAT PROTECTION will access UEFI and detect viruses there?

The answer is what you said before

 

[ciao]

The answer is what you said before

So that's right ok but I was wondering if somehow ESET's access can be interrupted or not notice the changes so for sure?

 

[Shadowra]

So that's right ok but I was wondering if somehow ESET's access can be interrupted or not notice the changes so for sure?

No. If there is a modification, it will be detected, as I told you

 

[ciao]

No. If there is a modification, it will be detected, as I told you

Well, (I'm a little paranoid about this, sorry if I'm boring too much ) is this not valid on Legacy systems?

and advanced threat protection on UEFI systems also works, accesses and detects and that's for sure right?

 

[Shadowra]

Well, (I'm a little paranoid about this, sorry if I'm boring too much ) is this not valid on Legacy systems?

Advanced protection no. Analysis yes

and advanced threat protection on UEFI systems also works, accesses and detects and that's for sure right?

Yes

 

[ciao]

Advanced protection no. Analysis yes

No, it's not, I'm asking if it's not valid for Legacy systems to notify if there is a change.

 

[Freki123]

https://cybernews.com/security/hackers-are-now-dropping-malware-into-ssd-drives-through-firmware-updates/

Anything that would check for that ? Not worried as an enduser but I'm curious now.

 

[ciao]

Advanced protection no. Analysis yes



Yes

translation is wrong that's why I misread advanced threat protection can't access but you said change is analyzed sorry

But if there was a change on legacy systems before ESET was installed, can ESET still detect it? @Shadowra

 

[Shadowra]

translation is wrong that's why I misread advanced threat protection can't access but you said change is analyzed sorry

But if there was a change on legacy systems before ESET was installed, can ESET still detect it? @Shadowra

Theoretically not.

No problem for the translation

 

[ciao]

Theoretically not.

No problem for the translation

Practically?

There was a problem with Google translation, because you wrote "no" and put a period, the "number" understood it.

 

[Shadowra]

Practically?

There was a problem with Google translation, because you wrote "no" and put a period, the "number" understood it.

I'll make it simpler:

If the system is in LEGACY, Eset does not scan the MBR.
The LEGACY system is no longer used on new PCs and new OSs

If the system is in UEFI / EFI, Eset detects the changes (included in the protection against advanced threats) and can also scan and clean! (.EFI file that is scanned if you do a scan) .
This is a solution that has been integrated into Eset 8 from memory to counter the arrival of Bootkit (like TDL4 / Alureon) and other Ransomware MBRLocker .

I hope I was simple in my explanations